fixed errors in csrf and flash tmpl func