Fixes #3 - Add csrf to controllers