Code review
Refactor CSRF, add cookie and session-based