Add CSRF protection for existing POST routes