add csrf protection to settings