add csrf_token in a few forms