diff --git a/modules/backend/widgets/Lists.php b/modules/backend/widgets/Lists.php
index 17d45631f..c4bfd4f43 100644
--- a/modules/backend/widgets/Lists.php
+++ b/modules/backend/widgets/Lists.php
@@ -1172,6 +1172,7 @@ class Lists extends WidgetBase
 
     /**
      * Process as text, escape the value
+     * @return string
      */
     protected function evalTextTypeValue($record, $column, $value)
     {
@@ -1188,6 +1189,7 @@ class Lists extends WidgetBase
 
     /**
      * Process as number, proxy to text
+     * @return string
      */
     protected function evalNumberTypeValue($record, $column, $value)
     {
diff --git a/modules/cms/classes/Controller.php b/modules/cms/classes/Controller.php
index ab7d57ad4..594e6f5a5 100644
--- a/modules/cms/classes/Controller.php
+++ b/modules/cms/classes/Controller.php
@@ -1657,7 +1657,7 @@ class Controller
         $token = Request::input('_token') ?: Request::header('X-CSRF-TOKEN');
 
         if (!$token && $header = Request::header('X-XSRF-TOKEN')) {
-            $token = Crypt::decrypt($header);
+            $token = Crypt::decrypt($header, false);
         }
 
         if (!strlen($token) || !strlen(Session::token())) {