feat(http): XSRF protection.

Closes #197