luci-base: protect CBI forms with CSRF tokens