add csrf token to user removal form

fixes #13