added automatic csrf protection as default in controllers