diff --git a/CHANGES.rst b/CHANGES.rst
index efedb17..70bc96a 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -10,6 +10,9 @@ Changelog
 - Make fieldset creation optional
   [ebrehault]
 
+- Add CSRF protection token
+  [ebrehault]
+
 
 2.0.1 (2014-10-23)
 ------------------
diff --git a/plone/schemaeditor/browser/schema/schema_listing.pt b/plone/schemaeditor/browser/schema/schema_listing.pt
index adb694b..5bfd79c 100644
--- a/plone/schemaeditor/browser/schema/schema_listing.pt
+++ b/plone/schemaeditor/browser/schema/schema_listing.pt
@@ -16,6 +16,7 @@
 
   <metal:form metal:use-macro="context/@@ploneform-macros/form">
     <metal:top-slot metal:fill-slot="formtop">
+      <input tal:replace="structure context/@@authenticator/authenticator" />
       <script type="text/javascript"
               tal:attributes="src context/++resource++schemaeditor.js"></script>
       <style type="text/css">
diff --git a/plone/schemaeditor/browser/schema/schemaeditor.js b/plone/schemaeditor/browser/schema/schemaeditor.js
index e0e8b33..9d145cb 100644
--- a/plone/schemaeditor/browser/schema/schemaeditor.js
+++ b/plone/schemaeditor/browser/schema/schemaeditor.js
@@ -139,7 +139,9 @@
             if (!confirm(trigger.attr('data-confirm_msg'))) {
                 return;
             }
-            $.post(trigger.attr('href'), null, function (data) {
+            $.post(trigger.attr('href'), {
+                _authenticator: $('input[name="_authenticator"]').val(),
+            }, function (data) {
                 trigger.closest('.fieldPreview').detach();
             }, 'text');
         });
@@ -147,12 +149,16 @@
         $('.fieldPreview.orderable').plone_schemaeditor_html5_sortable(function (position, fieldset_index) {
             var url = window.location.href.replace('/@@fields', '') + '/' + this.attr('data-field_id') + '/@@order';
             $.post(url, {
+                _authenticator: $('input[name="_authenticator"]').val(),
                 pos: position,
                 fieldset_index: fieldset_index
             });
         }, function (fieldset_index) {
             var url = window.location.href.replace('/@@fields', '') + '/' + this.attr('data-field_id') + '/@@changefieldset';
-            $.post(url, { fieldset_index: fieldset_index });
+            $.post(url, {
+                _authenticator: $('input[name="_authenticator"]').val(),
+                fieldset_index: fieldset_index
+            });
         });
         set_id_from_title = function () {
             var id = $.plone_schemaeditor_normalize_string($(this).val());
diff --git a/plone/schemaeditor/fields.py b/plone/schemaeditor/fields.py
index 5054c91..052304b 100644
--- a/plone/schemaeditor/fields.py
+++ b/plone/schemaeditor/fields.py
@@ -53,6 +53,9 @@ def editable(self, field):
 
 def FieldsVocabularyFactory(context):
     field_factories = getUtilitiesFor(IFieldFactory)
+    if context.allowedFields is not None:
+        field_factories = [(id, factory) for id, factory in field_factories
+                            if id in context.allowedFields]
     terms = []
     for (field_id, factory) in field_factories:
         terms.append(SimpleVocabulary.createTerm(factory,