fix(http): CSRF tokens are validated again.

Fixes #18