added csrf protection to the form