Reinclude explicit csrf on certain routes for v3.

Signed-off-by: crynobone <crynobone@gmail.com>