add CsrfProtection (delete action)