Added csrf protection.

Set up csurf. Closes #1.