Flow: Add CSRF protection

Change-Id: I15ae4ed95266ad0301fffa00eba6189cfa7dd91b