Added CSRF protection and changed sensitive operations to POST, closes #24