WIP Csrf plug

very rough
I think we should reverse this. @methods should be a list of methods that are protected, and we should rename it to `@protected_methods`