Set CSRF token in registration form
Lock down and clarify nopassword