YII2 form generate _csrf for form manually
<form action='#' method='POST'>
<input type="hidden" name="_csrf" value="<?=Yii::$app->request->getCsrfToken()?>" />
....
</form>
