add CSRF protection

app/templates/index.html

@@ -14,9 +14,10 @@
 {%endif%}
 {%endwith%}
 
-	<form method="POST" action="/login">
-		<input type="text" name="user" placeholder="username" required autofocus /><br />
-		<input type="password" name="pass" placeholder="password" required /><br />
+	<form method="POST" action="/">
+		{{ login_form.hidden_tag() }}
+		{{ login_form.username(placeholder="Username", autofocus=True) }}<br />
+		{{ login_form.password(placeholder="Password") }}<br />
 		<button type="submit">log in</button>
 	</form>
 </body>