Switched site to using HTTPS.
Added cross-site request forgery protection courtesy csurf.