add the forgotten CSRF attack html page