add csrf protection to the app