<form class="form-signin mt-4 text-center" action="/login" method="post">
    <input type="hidden" name="_csrf" value="{csrf-token}" />
    <label class="sr-only">Username:</label> <input type="text" name="username" class="form-control mb-1" required="required" autofocus="autofocus" placeholder="Username" />
    <label class="sr-only">Password:</label> <input type="password" name="password" class="form-control mb-4" required="required" placeholder="Password" />
    <div class="mb-4">
        <input type="submit" class="btn btn-primary btn-lrg btn-block" value="Login" />
    </div>
</form>

default-src 'self'; img-src 'self' data:; sandbox allow-scripts allow-forms;