CSFR

Prevent CSFR in the backend.

It isn't the best possible solution, but it should do the trick.
Each add/edit/delete-url should have a token-parameter, which is generated and stored in the session. Each time the action is accessed the token is validated.