templates: fix csrf stuff