Add CSRF-protection

// cc @tadatuta @tormozz48 @gela-d 
you may cache `this.params` into variable