Add csrf_protect for all POST method