Add csrf protection on setting form