add CSRF protection

app/templates/admin.html

@@ -7,11 +7,12 @@
 			<tr><th>Username</th><th>Domains</th><th>Password</th><th>Admin</th><th>Email</th><th>Delete</th></tr>
 			
 			<form method="POST" action="/create-user"><tr>
-				<td><input type="text" name="username" placeholder="*user name" required /></td>
-				<td><input type="text" name="domains" placeholder="space separated domains" /></td>
-				<td><input type="password" name="password" placeholder="*password" required /></td>
-				<td><input type="checkbox" name="is_admin" /></td>
-				<td><input type="email" name="email" placeholder="email" /></td>
+				{{ create_user_form.hidden_tag() }}
+				<td>{{ create_user_form.username(placeholder="*Username") }}</td>
+				<td>{{ create_user_form.domains(placeholder="Space separated domains") }}</td>
+				<td>{{ create_user_form.password(placeholder="*Password") }}</td>
+				<td>{{ create_user_form.is_admin() }}</td>
+				<td>{{ create_user_form.email(placeholder="Email") }}</td>
 				<td><button type="submit">Add</button></td>
 			</tr></form>
 
@@ -19,28 +20,33 @@
 			<tr>
 				<td>{{ user["username"] }}</td>
 				<td><form method="POST" action="/update-user">
+					{{ update_user_form.hidden_tag() }}
 					<input type="hidden" name="userid" value="{{ user["userid"] }}" />
 					<input type="text" name="domains" placeholder="space separated domains" value="{{ user["domains"] | join(' ') }}" />
 					<button type="submit">update domains</button>
 				</form></td>
 				<td><form method="POST" action="/update-user">
+					{{ update_user_form.hidden_tag() }}
 					<input type="hidden" name="userid" value="{{ user["userid"] }}" />
 					<input type="password" name="password" placeholder="*password" required />
 					<button type="submit">update password</button>
 				</form></td>
 				<td><form method="POST" action="/update-user">
+					{{ update_user_form.hidden_tag() }}
 					<input type="hidden" name="userid" value="{{ user["userid"] }}" />
 					<input type="hidden" name="is_admin" value="{% if user["is_admin"] %}false{% else %}true{% endif %}" />
 					<input type="checkbox" disabled {% if user["is_admin"] %}checked{% endif %} />
 					<button type="submit">toggle admin</button>
 				</form></td>
 				<td><form method="POST" action="/update-user">
+					{{ update_user_form.hidden_tag() }}
 					<input type="hidden" name="userid" value="{{ user["userid"] }}" />
 					<input type="email" name="email" placeholder="email" value="{{ user["email"] if user["email"] }}"/>
 					<button type="submit">update email</button>
 				</form></td>
 				<td><form method="POST" action="/delete-user">
-					<input type="hidden" name="userid" value="{{ user["userid"] }}" />
+					{{ delete_user_form.csrf_token }}
+					{{ delete_user_form.userid(value=user["userid"]) }}
 					<button type="submit">Delete</button>
 				</form></td>
 			</tr>