add csrf.token to all forms, fix Long Id usage
Merge remote-tracking branch 'origin/master'