Set code property on CSRF token errors

closes #24
closes #27