no bug - csrf added to nunjucks template. r=jon