add csrf filter to all 'post', 'put', and 'delete' requests