add xsrf_form_html() for all forms