diff --git a/members/mancredit.pl b/members/mancredit.pl
index 3617f2af90..e1a383aac3 100755
--- a/members/mancredit.pl
+++ b/members/mancredit.pl
@@ -55,7 +55,7 @@ if ($add){
 
         die "Wrong CSRF token"
             unless Koha::Token->new->check_csrf( {
-                session_id => $input->cookie('CGISESSID'),
+                session_id => scalar $input->cookie('CGISESSID'),
                 token  => scalar $input->param('csrf_token'),
             });
 
diff --git a/members/maninvoice.pl b/members/maninvoice.pl
index a6429aa40d..dfe3d1c65c 100755
--- a/members/maninvoice.pl
+++ b/members/maninvoice.pl
@@ -51,12 +51,12 @@ unless ( $patron ) {
 
 my $add=$input->param('add');
 if ($add){
-    die "Wrong CSRF token"
-        unless Koha::Token->new->check_csrf( {
-            session_id => $input->cookie('CGISESSID'),
-            token => scalar $input->param('csrf_token'),
-        });
     if ( checkauth( $input, 0, $flagsrequired, 'intranet' ) ) {
+        die "Wrong CSRF token"
+            unless Koha::Token->new->check_csrf( {
+                session_id => scalar $input->cookie('CGISESSID'),
+                token => scalar $input->param('csrf_token'),
+            });
         #  print $input->header;
         my $barcode=$input->param('barcode');
         my $itemnum;