Add CSRF-protection

// cc @tadatuta @tormozz48 @gela-d 
just use `{ tag: 'input', attrs: { type: 'hidden', name: '_csrf', val: req.csrf } }` instead.
input block is too huge for this.