Play: add CSRF protection