add csrf protection

app/templates/users/user_page.html

@@ -9,7 +9,7 @@
 {%- if target_user.id == get_active_user().id -%}
 <fieldset class="plank even no-shadow minimal thread-actions">
   <legend>Actions</legend>
-  <form action="{{url_for('users.log_out', username=target_user.username)}}" method="POST">
+  <form action="{{url_for('users.log_out')}}" method="POST">
     <input type="submit" class="warn" value="Log out">
   </form>
 </fieldset>
@@ -19,6 +19,7 @@
 <fieldset class="plank even no-shadow minimal thread-actions">
   <legend>Moderation actions</legend>
   <form method="POST">
+    {{csrf_input() | safe}}
     {%- if target_user.is_guest() -%}
     <input class="warn" type="submit" value="Approve user" formaction="{{url_for('mod.make_user_regular', user_id=target_user.id)}}">
     {%- else -%}