add CSRF protection to POST

Our PUT should not require it because sites can't trick
a user into a PUT.

Our GET should not require it since they shouldn't have side
effects in theory.

Our JSON posts should not require it since sites can't trick
a JSON content type, but added CSRF to these anyway.