<form action="/cart" method="POST">
  <input type="hidden" name="_csrf" value="<%= csrfToken %>">
  <input type="hidden" name="productId" value="<%= product._id %>">
  <button class="btn" type="submit">Add to Cart</button>
</form>
