Removed csrf. It was stupid anyway.

It may come back later as simple throttling.