[WIP] Csrf protection plug

Couldn't get the last 2 tests to pass. How to persist token in the session in the tests?
If we generate it here, it will necessarily be verified no matter what. So we'll need to expose the generate so it's call callable from elsewhere, i.e. the Views as you've discussed.