Add csrf protection to ALL forms and before filters for controllers
OVER 9000 REFACTORS