[WIP] Csrf protection plug

Couldn't get the last 2 tests to pass. How to persist token in the session in the tests?
This looks like it's unused? Where do we persist the token in the session? I'm not seeing token generation/persistence anywhere?