Fix meta fragment attribute-name for content
Add CSRF-check. Fixes #39