pre-fetch the CSRF token and add it to a hidden input field; fixes #4