luci-base: protect simpleforms with CSRF tokens