add csrf-token to non-get requests, add thing form to home page