added csrf protection to the base controller