Prevent CSRF attacks on project watch/unwatch

Thanks, ajaysinghnegi @ HackerOne!