Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.