add csrf protection for play and angular