add CSRF token middleware
include CSRF token in a <meta>
don't use 'secure' cookies, which need https
pass back csrf token in ajax POST