Secured with CSRF protection & rate limiting