Auth::csrfField() doesn't exist — replaced all 24 occurrences across org modules
with the correct <input type="hidden" name="_csrf" value="<?= Auth::csrfToken() ?>">.
Also fixed org-leaderboards index.php which was actually the org-board view (using
$org variable that wasn't passed by the index action), renamed it to org-board.php
and created a proper index.php for global rankings. Fixed org_members column name
(user_id → player_id) in org-applications controller.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>