Add csrf tokens

Fix PUT auth