add csrf protection to apis