added CSRF protection; briefly tested it seems to work
Merge branch 'master' of https://github.com/verily-org/verily