Fix csrf validation

Adds validation for CSRF tokens.  Fixes #1093

When combined with #1115, looks like:

![capture 25](https://cloud.githubusercontent.com/assets/1271535/3144498/d4fa76d6-ea22-11e3-9e20-20ca1e8b94bf.jpg)