diff --git a/bodhi/tests/test_controllers.py b/bodhi/tests/test_controllers.py
index d65b8bf..e0e8b0a 100644
--- a/bodhi/tests/test_controllers.py
+++ b/bodhi/tests/test_controllers.py
@@ -18,6 +18,10 @@ from bodhi.model import Release, PackageUpdate, User, PackageBuild, Bugzilla, \
 from bodhi.controllers import Root
 from bodhi.exceptions import DuplicateEntryError
 
+import turbogears
+from fedora.tg.util import enable_csrf
+
+turbogears.startup.call_on_startup.append(enable_csrf)
 cherrypy.root = Root()
 
 def create_release(num='7', dist='dist-fc'):
@@ -36,12 +40,16 @@ def login(username='guest', display_name='guest', group=None):
             guest.addGroup(group)
     except DuplicateEntryError:
         guest = User.by_user_name(username)
-    testutil.create_request('/updates/login?tg_format=json&login=Login&forward_url=/updates/&user_name=%s&password=guest' % username, method='POST')
+    testutil.create_request('/updates/login')
+    body = cherrypy.response.body[0]
+    csrf_token = body.split('<form action="/updates/login?_csrf_token=')[1].split('"')[0]
+    print "csrf_token =", csrf_token
+    testutil.create_request('/updates/login?tg_format=json&login=Login&forward_url=/updates?_csrf_token=%s&user_name=%s&password=guest&_csrf_token=%s' % (csrf_token, username, csrf_token), method='POST')
     assert cherrypy.response.status == '200 OK', cherrypy.response.body[0]
     cookies = filter(lambda x: x[0] == 'Set-Cookie',
                      cherrypy.response.header_list)
     cookiehdr = cookies[0][1].strip()
-    return { 'Cookie' : cookiehdr }
+    return { 'Cookie' : cookiehdr, '_csrf_token': csrf_token }
 
 class TestControllers(testutil.DBTest):