Add CSRF token to command requests

This adds support for CSRF tokens on the front-end.

@pdehaan r?