Added CSRF protection to all POST requests. Cleaned up controllers slightly