Added CSRF checks and group specific permissions