[WIP] Csrf protection plug

Couldn't get the last 2 tests to pass. How to persist token in the session in the tests?
Rails makes this behaviour configurable. I don't remember the exact discussion on Rails land but we should revisit the why's there.