Add some basic csrf protection, fixes #99