Fix missing CSRF token in visibility set form