Protect connect endpoint from CSRF

:eyeglasses: @spladug

This is a prereq for the csrf_exempt stuff