Add CSRF to the frontend and backend. RE: #1874