Add CSRF support

- add csrf token to locals/values
- add csrf hidden field if token exists
- bump version
- add changelog