initial CSRF protect laid out

https://app.asana.com/0/19128794071969/20811486365154
https://app.asana.com/0/19128794071969/20811486365156