add back csrf
modified:   tour/settings.py
modified:   tour/views.py