Use form_tag to add missing CSRF token.