correctly checking CSRF tokens for all 'dangerous' HTTP methods