Add IP and User-Agent checks in CSRF token validation