implement CSRF token and validation

Signed-off-by: Andre Dublin <81dublin@gmail.com>