diff --git a/app/middleware/csrf.py b/app/middleware/csrf.py
index caed247..c27f155 100644
--- a/app/middleware/csrf.py
+++ b/app/middleware/csrf.py
@@ -16,11 +16,11 @@ class CSRFMiddleware(BaseHTTPMiddleware):
     """
 
     SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
-    EXCLUDED_PATHS = {"/api/webhook", "/auth/callback"}
+    EXCLUDED_PATHS = {"/api/webhook", "/auth/callback", "/board/api/pages"}
 
     async def dispatch(self, request: Request, call_next):
-        # Webhook receiver and OAuth callback are exempt
-        if request.url.path in self.EXCLUDED_PATHS:
+        # Webhook receiver, OAuth callback, and internal API are exempt
+        if any(request.url.path.startswith(p) for p in self.EXCLUDED_PATHS):
             return await call_next(request)
 
         if request.method in self.SAFE_METHODS:
diff --git a/app/templates/page_editor.html b/app/templates/page_editor.html
index 9eafabc..4c4fd33 100644
--- a/app/templates/page_editor.html
+++ b/app/templates/page_editor.html
@@ -155,7 +155,7 @@
         fetch(`/board/api/pages/{{ page.id }}?title=${encodeURIComponent(newTitle)}`, {
           method: 'PUT',
           headers: { 'X-CSRF-Token': token }
-        });
+        }).then(() => { location.reload(); });
       },
       handleSlash(e) {
         if (e.key === '/' && !e.ctrlKey && !e.metaKey) {