Add JSON api for game events

Also turn back on csrf protection