restore CSRF in templates