Add CSRF mitigation extension