Use null_session forgery protection strategy
Add JSON token validation before executing posts create action (server-side)