update forms to flask-wtf changes regarding csrf tokens