install flask_wtf csrf extension - all post/put views are protected by default