Closes #8, adds csrf protection for DELETE requests