WIP Csrf plug

very rough
looks like verified_request? and authenticity_token_valid? can be moved into a single function.