Add csrf.js, as suggested by @ET-CS, fixes #49.