fix <form> attribute and csf token