feat(server): add XSRF protection