[REVIEW] csrf protection

We should make this an ansible variable right?