Add csrf to participant-add and remove url param for security