now validating CSRF tokens when modifying data