move form and csrf token to product_base to avoid caching csrf problem