luci-app-splash: protect admin status call with csrf token