Prevent CSRF attacks on sign-in

Thanks, robin @ HackerOne!