Add csrf to delete plugin