add csrf protection

app/util.py

@@ -1,5 +1,6 @@
-from flask import url_for
+from flask import url_for, session
 from .models import Posts, Threads
+from .auth import is_logged_in
 
 def get_post_url(post_id, _anchor=False, external=False):
     post = Posts.find({'id': post_id})
@@ -14,3 +15,12 @@ def get_post_url(post_id, _anchor=False, external=False):
 
 def dict_to_query_string(d) -> str:
     return '?' + '&'.join([f'{key}={str(value)}' for key, value in d.items()])
+
+def get_csrf_token():
+    if not is_logged_in():
+        return ''
+
+    return session.get('csrf', '')
+
+def csrf_input():
+    return f'<input type="hidden" name="csrf" value="{get_csrf_token()}">'