app: fix import ordering
requirements: add flask-csrf
app: enable CSRF verification, using flask-csrf extension
templates/confirmation: add hidden field containing csrf_token
templates/index: add hidden field containing csrf_token
app: change teardown_request so it checks for connection before closing

Flask executes @app.before_request function hooks in a chain, and abort
the execution when one of the hooks fail. Whenever the CSRF token
validation fail, it will not run before_request function, so
teardown_request will try to close a connection that does not exist.