CSRF protection

Issue: #39