Fix: add CSRFToken to the base template