Add CSRF protection request spec