Password reset forms: Add CSRF token.

Since these forms aren't using ajax, it is
necessary to manually inject the token.