refactor form for Flask-WTF, add CSRF protection

* Adds Flask-WTF form class for username lookup
* Template renders CSRF protection hidden tag