global csrf

netig.rb

@@ -9,7 +9,7 @@ class Netig < Roda
   plugin :public
   plugin :default_headers, "Content-Type" => "text/html; charset=utf-8"
   plugin :sessions, secret: ENV.fetch("SESSION_SECRET")
-  plugin :route_csrf
+  plugin :route_csrf, csrf_failure: :empty_403
   plugin :hash_branches
   plugin :flash
 
@@ -17,6 +17,7 @@ class Netig < Roda
 
   route do |r|
     r.public
+    check_csrf!
     r.hash_branches
 
     r.root do

routes/contact.rb

@@ -11,8 +11,6 @@ class Netig
     end
 
     r.post "send" do
-      check_csrf!
-
       form = ContactForm.new(r.params)
 
       if form.spam?