Started working on Csrf (but the class is not public since there is no session storage implementation