forms: render csrf_token - should be empty if csrf is disabled in config
update flask-wtf to 0.8.2