Optional cross-site request forgery tooken protection implemented