Add CSRF-protection

// cc @tadatuta @tormozz48 @gela-d 
you won't need this template after switching to `{ tag: 'input', /* ... */ }`