WIP: Add CSRF token for write operations

#98
We should also make sure that non-write operations work without token or even with invalid tokens.