flask-wtf csrf protection so rando's aren't installing stuff (probably)