<form action="/cart" method="post">
    <input type="hidden" name="_csrf" value="<%= csrfToken %>">
    <button class="btn" type="submit">Add to Cart</button>
    <input type="hidden" name="productId" value="<%= product._id %>">
</form>