Create, Update, Destroy + anti csrf

Better protection against csrf
create user endpoint
Update user endpoint
Destroy action