Add CSRF protection

Add unique per-user tokens to POST requests to mitigate CSRF attack
exposure.

Bug: 59612
Change-Id: I8b88666329d6ffe560e25169d05c6f06fb69033e