Move CSRF action filter to BaseController.php