app: remove flask-csrf

Flask-WTF already provides this feature.
templates/index: render form using information from the context