add CSRFProtection observer