Form submission needs CSRF protection

Form submissions are currently vulnerable to CSRF attacks. It's not like there's secure information here, but it wouldn't be right to release with a known vulnerability.

The issue names no files, tests, or entry points. Start by locating the Go code that handles form submissions, then determine how CSRF protection should cover those requests; done means submissions reject forged requests while legitimate submissions continue to work.

Written by the indexing model from the issue text.