Bug 917

This should enable csrf protection throughout the site.