Add CSRF token on:

- GET extension/activate/{id}
- GET extension/deactivate/{id}
- GET extension/migrate/{id}
- DELETE user/{id}

Signed-off-by: crynobone <crynobone@gmail.com>