add csrf protection for admin