Add login_required and csrf_protect to mask(). Remove redundant login_name from form2.html.