Front end progress is slow, but csrf support mostly in place.  Sort of.