Fix CSRF failure posting permission change form

Add missing `{% csrf_token %}` in form.

fixes #18