Fix CSRF form element default state