Add CSRF protection to site settings page