call the function format_html with 2 arguments: string "<input type='hidden' name='csrfmiddlewaretoken' value='{0}' />",
return format_html ( "<input type='hidden' name='csrfmiddlewaretoken' value='{0}' />" , csrf_token )