[WIP] Csrf protection plug

Couldn't get the last 2 tests to pass. How to persist token in the session in the tests?
Oh right, good point. We have to do it before. Yeah I think generate it on get requests in the non `@protected_methods` clause would be fine.