Get CSRF protection working (fixes #21)

:sunglasses: