fix csrf: apply csrf for every form