Add CSRF protection in admin