Fix #4: Add form name to CSRF token