Fix CSRF failure posting permission change form

Add missing `{% csrf_token %}` in form.

fixes #18
Merge pull request #24 from gthb/issue18

Fix CSRF failure posting permission change form