Forms that use GET should not have a csrf_token