add CSRF protection to all forms