fix missing csrf_token
move repetitive code in views into a decorator