Add CSRF-protection

// cc @tadatuta @tormozz48 @gela-d 
why have you kept it?