[Cullinan #11] Add CSRF and SSRF