Index: lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/PolicyManagementController.java
===================================================================
diff -u -rf2ad75cef0c507a64877942631fee13efbc6ed50 -r3a9b27c6f8b3eb0462a2a9d91a6aa0b43645442f
--- lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/PolicyManagementController.java	(.../PolicyManagementController.java)	(revision f2ad75cef0c507a64877942631fee13efbc6ed50)
+++ lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/PolicyManagementController.java	(.../PolicyManagementController.java)	(revision 3a9b27c6f8b3eb0462a2a9d91a6aa0b43645442f)
@@ -29,6 +29,7 @@
 import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.util.HtmlUtils;
 
@@ -189,7 +190,7 @@
 	return "policies/policies";
     }
 
-    @RequestMapping("togglePolicyStatus")
+    @RequestMapping(path = "togglePolicyStatus", method = RequestMethod.POST)
     public String togglePolicyStatus(HttpServletRequest request) {
 
 	long policyUid = WebUtil.readLongParam(request, "policyUid");
Index: lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/ToolContentListController.java
===================================================================
diff -u -rf2ad75cef0c507a64877942631fee13efbc6ed50 -r3a9b27c6f8b3eb0462a2a9d91a6aa0b43645442f
--- lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/ToolContentListController.java	(.../ToolContentListController.java)	(revision f2ad75cef0c507a64877942631fee13efbc6ed50)
+++ lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/ToolContentListController.java	(.../ToolContentListController.java)	(revision 3a9b27c6f8b3eb0462a2a9d91a6aa0b43645442f)
@@ -193,15 +193,15 @@
 	return true;
     }
 
-    @RequestMapping("/disable")
+    @RequestMapping(path = "/disable", method = RequestMethod.POST)
     public String disableLibrary(HttpServletRequest request) {
 	Long learningLibraryId = WebUtil.readLongParam(request, "libraryID", false);
 	ILearningDesignService ldService = learningDesignService;
 	ldService.setValid(learningLibraryId, false);
 	return "forward:/toolcontentlist/start.do";
     }
 
-    @RequestMapping("/enable")
+    @RequestMapping(path = "/enable", method = RequestMethod.POST)
     public String enableLibrary(HttpServletRequest request) {
 	Long learningLibraryId = WebUtil.readLongParam(request, "libraryID", false);
 	ILearningDesignService ldService = learningDesignService;
@@ -275,4 +275,4 @@
 	
 	return "forward:/toolcontentlist/start.do";
     }
-}
\ No newline at end of file
+}
Index: lams_admin/web/policies/policies.jsp
===================================================================
diff -u -r37bb2ae017713b44cdfd6a55cfceca28c3efab02 -r3a9b27c6f8b3eb0462a2a9d91a6aa0b43645442f
--- lams_admin/web/policies/policies.jsp	(.../policies.jsp)	(revision 37bb2ae017713b44cdfd6a55cfceca28c3efab02)
+++ lams_admin/web/policies/policies.jsp	(.../policies.jsp)	(revision 3a9b27c6f8b3eb0462a2a9d91a6aa0b43645442f)
@@ -53,7 +53,7 @@
 				var policyId = $(this).data("policy-id");
 				
 				$("#policy-table").load(
-					"togglePolicyStatus.do", 
+					"togglePolicyStatus.do?<csrf:token/>", 
 					{
 						policyUid: policyUid,
 						policyId: policyId,
@@ -71,7 +71,7 @@
 	<c:set var="help"><lams:help style="small" page="LAMS+Policies" /></c:set>
 	<lams:Page type="admin" title="${title}" titleHelpURL="${help}">
 		<p>
-			<a href="<lams:LAMSURL/>/admin/sysadminstart.do" class="btn btn-default">
+			<a href="<lams:LAMSURL/>admin/sysadminstart.do" class="btn btn-default">
 				<fmt:message key="sysadmin.maintain" />
 			</a>
 			<c:if test="${viewPreviousVersions}">
@@ -92,4 +92,4 @@
 		</c:if>
 	</lams:Page>
 </body>
-</lams:html>
\ No newline at end of file
+</lams:html>
Index: lams_admin/web/toolcontent/toolcontentlist.jsp
===================================================================
diff -u -r37bb2ae017713b44cdfd6a55cfceca28c3efab02 -r3a9b27c6f8b3eb0462a2a9d91a6aa0b43645442f
--- lams_admin/web/toolcontent/toolcontentlist.jsp	(.../toolcontentlist.jsp)	(revision 37bb2ae017713b44cdfd6a55cfceca28c3efab02)
+++ lams_admin/web/toolcontent/toolcontentlist.jsp	(.../toolcontentlist.jsp)	(revision 3a9b27c6f8b3eb0462a2a9d91a6aa0b43645442f)
@@ -87,17 +87,15 @@
 				<table class="table table-striped table-condensed voffset10">
 					<tr>
 						<th><fmt:message key="label.tool" /></th>
-						<th><fmt:message key="sysadmin.library.activity.description" /></th>
 						<th><fmt:message key="label.tool.version" /></th>
 						<th><fmt:message key="label.database.version" /></th>
 						<th style="padding-right: 15px"><fmt:message key="admin.user.actions" /></th>
 					</tr>
 					<c:forEach items="${toolLibrary}" var="dto">
 						<tr>
 							<td>
-								<c:out value="${dto.activityTitle}" />
-							</td>
-							<td>
+								<strong><c:out value="${dto.activityTitle}" /></strong>
+								<br/>
 								<c:out value="${dto.description}" />
 							</td>
 							<td>
@@ -109,21 +107,22 @@
 							<td>
 								<c:choose>
 									<c:when test="${learningLibraryValidity[dto.learningLibraryID]}">
-										[<a id="disable${dto.activityTitle}" href="<c:url value='disable.do?libraryID=${dto.learningLibraryID}' />" ><fmt:message key="admin.disable" /></a>] 
+										<csrf:form style="display: inline-block;" id="disable${dto.activityTitle}" method="post" action="disable.do"><input type="hidden" name="libraryID" value="${dto.learningLibraryID}"/><input type="hidden" name="disable" value="false"/><input type="submit" class="btn btn-xs btn-primary" value="<fmt:message key="admin.disable" />"/></csrf:form>
 									</c:when>
 									<c:otherwise>
-										[<a id="enable${dto.activityTitle}" href="<c:url value='enable.do?libraryID=${dto.learningLibraryID}' />" ><fmt:message key="admin.enable" /></a>]
+										<csrf:form style="display: inline-block;" id="enable${dto.activityTitle}" method="post" action="enable.do"><input type="hidden" name="libraryID" value="${dto.learningLibraryID}"/><input type="hidden" name="enable" value="false"/><input type="submit" class="btn btn-success btn-xs" value="<fmt:message key="admin.enable" />"/></csrf:form>
 										
 									</c:otherwise>
 								</c:choose>
 								<c:if test="${not empty dto.toolContentID}">
 									<c:set var="editDefaultContentUrl">
 										<lams:LAMSURL /><c:out value="${dto.authoringURL}" />?toolContentID=${dto.toolContentID}&contentFolderID=-1"
 									</c:set>
-									[<a id="defaultContent${dto.activityTitle}" href="${editDefaultContentUrl}" target="_blank"><fmt:message key="sysadmin.edit.default.tool.content" /></a>]
+									&nbsp;
+									<a class="btn btn-xs btn-default" id="defaultContent${dto.activityTitle}" href="${editDefaultContentUrl}" target="_blank"><fmt:message key="sysadmin.edit.default.tool.content" /></a>
 									<c:if test="${(displayToolManagement == 'true') and (dto.adminURL != null)}">
-										&nbsp;&nbsp;
-										[<a id="toolManagement${dto.activityTitle}" href="<lams:LAMSURL /><c:out value="${dto.adminURL}" />" ><fmt:message key="msg.tool.management" /></a>]
+										&nbsp;
+										<a class="btn btn-xs btn-default" id="toolManagement${dto.activityTitle}" href="<lams:LAMSURL /><c:out value="${dto.adminURL}" />" ><fmt:message key="msg.tool.management" /></a>
 									</c:if>
 								</c:if>
 							</td>
Index: lams_central/conf/security/Owasp.CsrfGuard.properties
===================================================================
diff -u -r1840d1ada2e0a7dc494e83ed0c183f6c98b6da92 -r3a9b27c6f8b3eb0462a2a9d91a6aa0b43645442f
--- lams_central/conf/security/Owasp.CsrfGuard.properties	(.../Owasp.CsrfGuard.properties)	(revision 1840d1ada2e0a7dc494e83ed0c183f6c98b6da92)
+++ lams_central/conf/security/Owasp.CsrfGuard.properties	(.../Owasp.CsrfGuard.properties)	(revision 3a9b27c6f8b3eb0462a2a9d91a6aa0b43645442f)
@@ -22,6 +22,8 @@
 org.owasp.csrfguard.protected.adminExtserverDelete=/lams/admin/extserver/delete.do
 org.owasp.csrfguard.protected.adminExtserverDisable=/lams/admin/extserver/disable.do
 org.owasp.csrfguard.protected.adminExtserverEnable=/lams/admin/extserver/enable.do
+org.owasp.csrfguard.protected.adminToolsDisable=/lams/admin/toolcontentlist/disable.do
+org.owasp.csrfguard.protected.adminToolsEnable=/lams/admin/toolcontentlist/enable.do
 
 org.owasp.csrfguard.protected.centralSaveUserProfile=/lams/saveprofile.do