add CSRF protection

Forgot that in my first PR