csrf protection

csrf protection for developers
I will sort it out tomorrow as a part of that PR