Added oauth2 CSRF protection (closes #266)