Update form tags to include a CSRF token by default (you can explicitly exclude it), bump version