Add CSRF Protection to Change Pass (#26)