use TokenTrait to setup CSRF token.
hidden tag's value are stored as _token.