add CSRF protection on auth views