CSRF protection for admin pages only closes #4
Not added for all since that would add overhead to proxy