[SEC] Add CSRF protection
[SEC] Add remote_referrer protection