added csrf token to play.html