[WIP] Csrf protection plug

Couldn't get the last 2 tests to pass. How to persist token in the session in the tests?
It is very hard to do in the views because the views would now have to return a new connection. In general I would argue for it to be generated before hand.