Add CSRF checking.