CSRF protection (closes #6)

Signed-off-by: Sergei Ianovich <ynvich@gmail.com>