add CSRF test for password form