[REVIEW] csrf protection

2 down, countless to go...