add csrf check to add-email call