added support for CSRF protection