Add CSRF protection to auth api routes