Add CSRF protection to all form posts

Closes #54