add csrf protection
implement basics of session hijacking prevention