Add CSRF middleware to main app stack.