Need to add csrf token - Unique per session - use getEntropy and hash the base64 - provided in cookie when session is initiated - verify that the csrf token header matches the csrf token cookie (thereby proving the request originated on the frontend and isn't a csrf attack) - token should be sent in x-csrf-token request header - frontend should read the cookie and add the header for all submissions to protected endpoints.
Need to add csrf token