adds csrf protection to core