fix #1450 by adding CSRF-token to the mobile forms
fix mysql error on old migration. prevented ci from running