add csrf protection to all forms but search [Updates #184]