CRUD with CSRF protection