Use CSRF on all other location.

Signed-off-by: crynobone <crynobone@gmail.com>
Use timing safe string comparison in CSRF filter

Signed-off-by: crynobone <crynobone@gmail.com>