[REVIEW] csrf protection

Hah I came across this once but I thought we're not using any Symfony forms apart from the headless one in the API, but I see you're using it now to help other forms ;-)