diff --git a/ckanext/relationships/logic/auth/create.py b/ckanext/relationships/logic/auth/create.py
index 514edbc..b237acd 100644
--- a/ckanext/relationships/logic/auth/create.py
+++ b/ckanext/relationships/logic/auth/create.py
@@ -39,7 +39,7 @@ def package_relationship_create(context, data_dict):
     # to the subject package that they were updating (i.e. the package they
     # DO have `package_update` permission for.
     #
-    if roles_allowed and authz.auth_is_loggedin_user:
+    if roles_allowed and not toolkit.current_user.is_anonymous:
         # On new datasets the context.get('package') has not been set yet, so need to use package_show for the subject
         # data_dict['subject'] is always the ID of the package being created/updated
         context_package = toolkit.get_action('package_show')(context, {"id": data_dict['subject']})
diff --git a/ckanext/relationships/templates/package/relationships.html b/ckanext/relationships/templates/package/relationships.html
index bb12b3d..807d860 100644
--- a/ckanext/relationships/templates/package/relationships.html
+++ b/ckanext/relationships/templates/package/relationships.html
@@ -51,7 +51,7 @@ <h3>CKAN dataset to dataset relationship</h3>
     {% if relatable_datasets %}
 
         <form action="/dataset/{{ pkg_dict['name'] }}/relationships/create" method="post">
-
+            {{ h.csrf_input() }}
             This dataset <select name="type">
                 {% for option in h.get_relationship_types() %}
                     <option value="{{ option[0] }}">{{ option[0] }}</option>
@@ -77,7 +77,7 @@ <h4>There are no other datasets to link to.</h4>
     <h3>CKAN dataset to external URI relationship</h3>
 
     <form action="/dataset/{{ pkg_dict['name'] }}/relationships/create" method="post">
-
+        {{ h.csrf_input() }}
         This dataset <select name="type">
             {% for option in h.get_relationship_types() %}
                 <option value="{{ option[0] }}">{{ option[0] }}</option>