adds a token to protect against csrf when creating components and rendering reports; closes #113