Add CSRF protection to admin forms