added csrf module for convenient protection of 'simple' POST pages (with 'html
only' forms, without rendered wtforms instances)