[QOLSVC-3186] preserve CSRF token in API token deletion form

[ThrawnCA]

• The confirm-action module drops form fields by default, we need to retain them