Add state CSRF protection.