Update csrf protection
Add more tests