diff --git a/helios/templates/election_edit.html b/helios/templates/election_edit.html
index 0c6c08c3755b815d4bbc4294f8b9baece1a22ff6..2519fb704d4e74a821a43cd792505179961cd8f4 100644
--- a/helios/templates/election_edit.html
+++ b/helios/templates/election_edit.html
@@ -11,6 +11,7 @@
 {% endif %}
   
   <form class="prettyform" action="" method="POST" id="edit_election_form">
+    <input type="hidden" name="csrf_token" value="{{csrf_token}}" />
     <table class="pretty">
      {{election_form.as_table}}
      </table>
diff --git a/helios/templates/election_new.html b/helios/templates/election_new.html
index 43a602fba91b72da5b7949b4feb0c20f35b68143..1e5e2ec0f97a2eaa1e7f633c4217d0b4732eed0d 100644
--- a/helios/templates/election_new.html
+++ b/helios/templates/election_new.html
@@ -11,6 +11,7 @@
 {% endif %}
   
   <form class="prettyform" action="" method="POST" id="create_election_form">
+    <input type="hidden" name="csrf_token" value="{{csrf_token}}" />
     <table class="pretty">
      {{election_form.as_table}}
      </table>
diff --git a/helios/templates/new_trustee.html b/helios/templates/new_trustee.html
index d41079c189e29ee80a23afecc8b83d5f8921832f..0df1a27c287fcb2a8a960315604ea7e94ec37370 100644
--- a/helios/templates/new_trustee.html
+++ b/helios/templates/new_trustee.html
@@ -4,6 +4,7 @@
   <h2 class="title">{{election.name}} &mdash; New Trustee <span style="font-size:0.7em;">[<a href="{% url "helios.views.list_trustees_view" election.uuid %}">cancel</a>]</span></h2>
   
 <form method="post" action="">
+<input type="hidden" name="csrf_token" value="{{csrf_token}}" />
 Name: <input type="text" name="name" size="60" /><br /><br />
 Email: <input type="text" name="email" size="60" /><br /><br />
 
diff --git a/helios/tests.py b/helios/tests.py
index b3ed32a94c8c5d8b1de99a4eef0fc9df315a22cd..9389c4f0ad1fcefe9056f00968e79c1d5fed41cb 100644
--- a/helios/tests.py
+++ b/helios/tests.py
@@ -527,7 +527,9 @@ class ElectionBlackboxTests(WebTest):
             "election_type" : "referendum",
             "use_voter_aliases": "0",
             "use_advanced_audit_features": "1",
-            "private_p" : "False"}
+            "private_p" : "False",
+            'csrf_token': self.client.session['csrf_token']
+        }
 
         # override with the given
         full_election_params.update(election_params)
@@ -788,7 +790,8 @@ class ElectionBlackboxTests(WebTest):
                 "election_type" : "election",
                 "use_voter_aliases": "0",
                 "use_advanced_audit_features": "1",
-                "private_p" : "False"})
+                "private_p" : "False",
+                'csrf_token': self.client.session['csrf_token']})
 
         election_id = re.match("(.*)/elections/(.*)/view", response['Location']).group(2)
 
diff --git a/helios/views.py b/helios/views.py
index f218a1a200583b759a5612f1adb80ff520557d49..ec998fb372fed7d5106abbd93a164fce3beaf38c 100644
--- a/helios/views.py
+++ b/helios/views.py
@@ -200,6 +200,7 @@ def election_new(request):
     election_form = forms.ElectionForm(initial={'private_p': settings.HELIOS_PRIVATE_DEFAULT,
                                                 'help_email': user.info.get("email", '')})
   else:
+    check_csrf(request)
     election_form = forms.ElectionForm(request.POST)
     
     if election_form.is_valid():
@@ -247,6 +248,7 @@ def one_election_edit(request, election):
       values[attr_name] = getattr(election, attr_name)
     election_form = forms.ElectionForm(values)
   else:
+    check_csrf(request)
     election_form = forms.ElectionForm(request.POST)
     
     if election_form.is_valid():
@@ -399,6 +401,7 @@ def new_trustee(request, election):
   if request.method == "GET":
     return render_template(request, 'new_trustee', {'election' : election})
   else:
+    check_csrf(request)
     # get the public key and the hash, and add it
     name = request.POST['name']
     email = request.POST['email']