Add CSRF checks to message.php