Implement CSRF protection for REST interface (fixes #287)
Implement API keys