add protection against CSRF attacks by using a session token

this is only used when a user is logged in
don't pass component, we can get it from view

simplifies templates
correctly initialize var
fix for time-width in date-time-field

was a little too small