add csrf token to sign up form on homepage; fix #58
send withdrawal confirmation emails from the user trust service