diff --git a/contrib/templates/default/board.mustache b/contrib/templates/default/board.mustache
index 01dd049..71c07df 100644
--- a/contrib/templates/default/board.mustache
+++ b/contrib/templates/default/board.mustache
@@ -32,7 +32,7 @@
     <div class="board_header_catalog"><a href="{{board.Prefix}}catalog-{{board.Name}}.html"> Catalog </a></div>
     <!-- postform -->
     <div id="postform_container">
-      {{{form}}}
+      {{{board.PostForm}}}
     </div>
     <hr />
     <div id="threads_container">
diff --git a/contrib/templates/default/modlogin.mustache b/contrib/templates/default/modlogin.mustache
index fb8e584..5f9643c 100644
--- a/contrib/templates/default/modlogin.mustache
+++ b/contrib/templates/default/modlogin.mustache
@@ -9,6 +9,7 @@
       <label for="mod_key">secret</label>
       <input type="password" id="mod_key" name="privkey" />
       <input type="submit" value="login" />
+      {{{csrfField}}}
     </form>
   </body>
 </html>
diff --git a/contrib/templates/default/postform.mustache b/contrib/templates/default/postform.mustache
index 4edf3a4..6a5370e 100644
--- a/contrib/templates/default/postform.mustache
+++ b/contrib/templates/default/postform.mustache
@@ -6,8 +6,10 @@
  - reference ( the post we are replying to, or empty string if it's an op )
  - button ( the text for the reply button )
  - files ( bool, do we allow attachments ? )
+ - csrf ( csrf token )
  }}
  <form action="{{post_url}}" enctype="multipart/form-data" name="post" method="post">
+ {{{csrf}}}
  <input type="hidden" name="reference" value="{{reference}}" />
  <div id="postform-outer">
    <div id="postform-inner">
diff --git a/contrib/templates/default/thread.mustache b/contrib/templates/default/thread.mustache
index 8a9234e..ecbf3b9 100644
--- a/contrib/templates/default/thread.mustache
+++ b/contrib/templates/default/thread.mustache
@@ -3,7 +3,6 @@
  template parameters:
  - board ( the Board Model of the board this thread was posted in )
  - thread ( the Thread Model of the current thread being rendered )
- - form ( the post form markup )
  
  Thread Model attributes:
  - OP , the Post Model of the original poster
@@ -32,7 +31,7 @@
     <div class="board_header">{{thread.Board}}</div>
     <!-- postform -->
     <div id="postform_container">
-      {{{form}}}
+      {{{thread.PostForm}}}
     </div>
     <hr />
     <div class="thread" id="thread_{{thread.OP.PostHash}}">