Optimized login form - delegated CSRF token creation to thymeleaf

Also added additional test to verify behaviour.

Fixes gh-1039