added csrf protection to the widget forms