Fix: fixed security issue where login form is not protected against CSRF attacks

This is the first step in a fix for #29