Add CSRF preventation token.

Not that anyone would bother attacking this app...