Add CSRF tweak to admin template.
Remove CSRF exemption where it did not belong.