Part 3 of startup security - csrf