Implementing CSRF protection for api actions