libraries: update atomic accept headers in options
server: add CSRF protection middleware

setup `Backbone.ajax` on the client side to add required headers to all requests

check
  <http://blog.codinghorror.com/preventing-csrf-and-xsrf-attacks/>