Index: lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/UserController.java
===================================================================
diff -u -r1ef1213820fe7ff7c6f4a9238b3f489a25012c63 -read5d983137f06698c17843087000cb3545e7b34
--- lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/UserController.java	(.../UserController.java)	(revision 1ef1213820fe7ff7c6f4a9238b3f489a25012c63)
+++ lams_admin/src/java/org/lamsfoundation/lams/admin/web/controller/UserController.java	(.../UserController.java)	(revision ead5d983137f06698c17843087000cb3545e7b34)
@@ -89,7 +89,7 @@
     private static List<SupportedLocale> locales;
     private static List<AuthenticationMethod> authenticationMethods;
 
-    @RequestMapping(path = "/edit")
+    @RequestMapping("/edit")
     public String edit(@ModelAttribute UserForm userForm, HttpServletRequest request) throws Exception {
 	if (locales == null) {
 	    locales = userManagementService.findAll(SupportedLocale.class);
@@ -282,7 +282,7 @@
     }
 
     // determine whether to disable or delete user based on their lams data
-    @RequestMapping(path = "/remove", method = RequestMethod.POST)
+    @RequestMapping("/remove")
     public String remove(HttpServletRequest request) throws Exception {
 	if (!(request.isUserInRole(Role.SYSADMIN) || userManagementService.isUserGlobalGroupManager())) {
 	    request.setAttribute("errorName", "UserAction");
Index: lams_admin/web/remove.jsp
===================================================================
diff -u -r002370657c7bc0bf87eef9c223e1778f74483413 -read5d983137f06698c17843087000cb3545e7b34
--- lams_admin/web/remove.jsp	(.../remove.jsp)	(revision 002370657c7bc0bf87eef9c223e1778f74483413)
+++ lams_admin/web/remove.jsp	(.../remove.jsp)	(revision ead5d983137f06698c17843087000cb3545e7b34)
@@ -68,11 +68,17 @@
 								<c:param name="orgId" value="${orgId}" />
 							</c:url>
 							<div class="pull-right">
-								<csrf:form style="display: inline-block;" id="delete_${userId}" method="post" action="delete.do"><input type="hidden" name="userId" value="${userId}"/><input type="hidden" name="orgId" value="${orgId}"/><button type="submit" class="btn btn-danger"><fmt:message key="admin.delete" /></button></csrf:form>
-
 								<button class="btn btn-default" type="button" onClick="javascript:document.location='<c:out value="${cancel}"/>'">
 									Cancel
 								</button>
+							
+								<csrf:form style="display: inline-block;" id="delete_${userId}" method="post" action="delete.do">
+									<input type="hidden" name="userId" value="${userId}"/>
+									<input type="hidden" name="orgId" value="${orgId}"/>
+									<button type="submit" class="btn btn-danger">
+										<fmt:message key="admin.delete" />
+									</button>
+								</csrf:form>
 							</div>
 						</div>
 					</div>
Index: lams_admin/web/userlist.jsp
===================================================================
diff -u -r37bb2ae017713b44cdfd6a55cfceca28c3efab02 -read5d983137f06698c17843087000cb3545e7b34
--- lams_admin/web/userlist.jsp	(.../userlist.jsp)	(revision 37bb2ae017713b44cdfd6a55cfceca28c3efab02)
+++ lams_admin/web/userlist.jsp	(.../userlist.jsp)	(revision ead5d983137f06698c17843087000cb3545e7b34)
@@ -31,7 +31,6 @@
 	<script src="${lams}includes/javascript/jquery.tablesorter-pager.js" type="text/javascript"></script>
 	<script>
 		$(document).ready(function() {
-			
 			$(".tablesorter").tablesorter({
 				widthFixed:true,
 				theme: 'bootstrap',
@@ -159,18 +158,18 @@
 						    </small>
 						</td>
 						<td>
-								<c:if test="${userManageForm.canEditRole == true }">
-                                    <a title="<fmt:message key="admin.user.assign.roles"/>" href="<lams:LAMSURL/>admin/userroles.do?userId=<c:out value="${userManageBean.userId}" />&orgId=<c:out value="${userManageForm.orgId}"/>"><button type="button" class="btn btn-primary btn-xs"><i class="fa fa-users"></i> <span class="hidden-xs hidden-sm"><fmt:message key="admin.user.assign.roles"/></span></button></a>
-									&nbsp;
-								</c:if>
-								<c:if test="${userManageForm.courseAdminCanAddNewUsers == true }">
-                                    <a title="<fmt:message key="admin.edit" />" href="<lams:LAMSURL/>admin/user/edit.do?userId=<c:out value="${userManageBean.userId}" />&orgId=<c:out value="${userManageForm.orgId}"/>"><button type="button" class="btn btn-primary btn-xs"><i class="fa fa-pencil"></i> <span class="hidden-xs hidden-sm"><fmt:message key="admin.edit" /></span></button></a>
-									&nbsp;
-								</c:if>
-								<c:if test="${canDeleteUser == true}">
-                                    <a title="<fmt:message key="admin.user.delete"/>" href="<lams:LAMSURL/>admin/user/remove.do?userId=<c:out value="${userManageBean.userId}" />&orgId=<c:out value="${userManageForm.orgId}"/>"><button type="button" class="btn btn-danger btn-xs"><i class="fa fa-trash"></i> <span class="hidden-xs hidden-sm"><fmt:message key="admin.user.delete"/></span></button></a>
-								</c:if>
-								<br/>
+							<c:if test="${userManageForm.canEditRole}">
+                            	<a title="<fmt:message key="admin.user.assign.roles"/>" href="<lams:LAMSURL/>admin/userroles.do?userId=<c:out value="${userManageBean.userId}" />&orgId=<c:out value="${userManageForm.orgId}"/>"><button type="button" class="btn btn-primary btn-xs"><i class="fa fa-users"></i> <span class="hidden-xs hidden-sm"><fmt:message key="admin.user.assign.roles"/></span></button></a>
+								&nbsp;
+							</c:if>
+							<c:if test="${userManageForm.courseAdminCanAddNewUsers}">
+                            	<a title="<fmt:message key="admin.edit" />" href="<lams:LAMSURL/>admin/user/edit.do?userId=<c:out value="${userManageBean.userId}" />&orgId=<c:out value="${userManageForm.orgId}"/>"><button type="button" class="btn btn-primary btn-xs"><i class="fa fa-pencil"></i> <span class="hidden-xs hidden-sm"><fmt:message key="admin.edit" /></span></button></a>
+								&nbsp;
+							</c:if>
+							<c:if test="${canDeleteUser}">
+                            	<a title="<fmt:message key="admin.user.delete"/>" href="<lams:LAMSURL/>admin/user/remove.do?userId=<c:out value="${userManageBean.userId}" />&orgId=<c:out value="${userManageForm.orgId}"/>"><button type="button" class="btn btn-danger btn-xs"><i class="fa fa-trash"></i> <span class="hidden-xs hidden-sm"><fmt:message key="admin.user.delete"/></span></button></a>
+							</c:if>
+							<br/>
 						</td>		
 					</tr>
 				</c:forEach>
Index: lams_central/conf/security/Owasp.CsrfGuard.properties
===================================================================
diff -u -ra5d10fd1c9166f727f58d1ea1a1dadd04f503198 -read5d983137f06698c17843087000cb3545e7b34
--- lams_central/conf/security/Owasp.CsrfGuard.properties	(.../Owasp.CsrfGuard.properties)	(revision a5d10fd1c9166f727f58d1ea1a1dadd04f503198)
+++ lams_central/conf/security/Owasp.CsrfGuard.properties	(.../Owasp.CsrfGuard.properties)	(revision ead5d983137f06698c17843087000cb3545e7b34)
@@ -29,7 +29,6 @@
 org.owasp.csrfguard.protected.adminSessionManagementDelete=/lams/admin/sessionmaintain/delete.do
 org.owasp.csrfguard.protected.adminUserDisable=/lams/admin/user/disable.do
 org.owasp.csrfguard.protected.adminUserEdit=/lams/admin/user/edit.do
-org.owasp.csrfguard.protected.adminUserRemove=/lams/admin/user/remove.do
 org.owasp.csrfguard.protected.adminUserDelete=/lams/admin/user/delete.do
 org.owasp.csrfguard.protected.adminUserSaveDetails=/lams/admin/usersave/saveUserDetails.do
 org.owasp.csrfguard.protected.adminClearnupPreviewLessons=/lams/admin/cleanupPreviewLessons/delete.do