Add CSRF token in reset (Closes #242)