Enable CSRF protection to all object & batch actions by default
Update object action visuals
Change GET to POST request (to hide CSRF token from the user and browser's history)