Add CSRF mitigation extension
Allow only POST requests to /service/update
Add request key when running tests