csrf_field now returns HTML-escaped string
Add optional renew parameter to csrf_field to renew CSRF token