Protect connect endpoint from CSRF