csrf token fix

Token should be outside template so that compressing templates doesn't create different files for every user