Changed to use form.csrf_token instead of csrf_token (allow form to generate it however it wants, versus hard coding an input with specific name, etc.).