phonenote form didn't work since we enabled csrf, this is fixed by using form_open()