csrf protection (rebased onto develop)


This is the same as gh-1029 but rebased onto develop.

----

csrf protection for developers