Fix CSRF invalidation for the password reset form.

Remove csrf token injection in the password_reset form.

Fixes #167.