remove an unnecessary comment.
apply the csrf middleware.
add hidden field for csrf token to signin form.