diff --git a/site/org/install.sh b/site/org/install.sh
index 3d241faf..2310315a 100755
--- a/site/org/install.sh
+++ b/site/org/install.sh
@@ -46,18 +46,20 @@ objects() {     # objects <space> <page> <class>: how many the page has
         python3 -c 'import json,sys; print(len(json.load(sys.stdin).get("objectSummaries") or []))'
 }
 object() {      # object <space> <page> <class> <property=value>...: add one
+    # as XML: XWiki refuses a form-encoded POST without its form token (CSRF), not an XML one
     local s=$1 p=$2 c=$3; shift 3
-    local args=(--data-urlencode "className=$c")
-    for kv in "$@"; do args+=(--data-urlencode "property#$kv"); done
-    curl -fsS -o /dev/null -w "  $s.$p: $c added (%{http_code})\n" "${auth[@]}" -X POST "${args[@]}" \
-        "$rest/spaces/$s/pages/$p/objects"
+    local body
+    body=$(python3 -c '
+import sys
+from xml.sax.saxutils import escape
+props = "".join("<property name=\"%s\"><value>%s</value></property>" % (escape(k), escape(v))
+                for k, v in (a.split("=", 1) for a in sys.argv[2:]))
+print("<object xmlns=\"http://www.xwiki.org\"><className>%s</className>%s</object>" % (escape(sys.argv[1]), props))' "$c" "$@")
+    curl -fsS -o /dev/null -w "  $s.$p: $c added (%{http_code})\n" "${auth[@]}" -X POST \
+        -H 'Content-Type: application/xml' --data-binary "$body" "$rest/spaces/$s/pages/$p/objects"
 }
 
 echo "=== $base, as $user"
-page Main WebHome "StarshipOS" Main.WebHome.xwiki
-page Admin WebHome "Admin Dashboard" Admin.WebHome.xwiki
-page Contributors WebHome "Contributors' Dashboard" Contributors.WebHome.xwiki
-
 echo "=== the group $group"
 page XWiki StarshipContributors "Starship Contributors"
 if [ "$(objects XWiki StarshipContributors XWiki.XWikiGroups)" = 0 ]; then
@@ -84,6 +86,11 @@ else
     echo "  Contributors: rights there already, left as they are"
 fi
 
+echo "=== the pages -- after their spaces' rights, so a dashboard is never readable without them"
+page Main WebHome "StarshipOS" Main.WebHome.xwiki
+page Admin WebHome "Admin Dashboard" Admin.WebHome.xwiki
+page Contributors WebHome "Contributors' Dashboard" Contributors.WebHome.xwiki
+
 echo "=== as a guest"
 bad=
 for p in Main Admin Contributors; do