[core] Add CSRF protection to all requests
[core] Add csrf token in non-jQuery requests