CSRF token is missing

If you have a fusion based form on your page, only the trustedProperties are rendered as hidden fields.
That's usually not a problem, as long as your frontend user is not logged in.

**Cause:**
CSRF check is disabled if no user is authenticated. But if it is, it expects a valid CSRF token for every non-safe request.
The fusion form renderer is currently missing the hidden field `__csrfToken`.