Cross-site request forgery attack mitigation in Play!