Get CSRF protection working

:sunglasses: