CSRF Protection and Controller Filters