Add CSRF protection.