render hidden fields (e.g. CSRF) inside hidden DIV