Cross-Site Request Forgery: How to protect your app from CSRF attacks