login.html.twig

{% extends '::base.html.twig' %}

{% block body %}
    <form action="{{ path('my_security_login') }}" method="post">
        <input type="hidden" name="_csrf_token" value="{{ csrf_token }}" />

        {# Rest of the input fields and a submit button #}
    </form>
{% endblock %}

security.yml

# app/config/security.yml
security:
    firewalls:
        default:
            pattern: ^/
            form_login:
                login_path: diveshare_session_new
                check_path: diveshare_session_new
                csrf_provider: form.csrf_provider

SecurityController.php

<?php

class SecurityController
{
    public function loginAction()
    {
        // Here goes all the normal stuff like getting the last username and error
        // so we are playing $username and $error is already set.

        $csrfToken = $this->container->get('form.csrf_provider')->generateCsrfToken('authentication');

        return $this->container->renderResponse('MyBundle:Security:login.html.twig', array(
            'username' => $username,
            'error' => $error,
            'csrf_token' => $csrfToken,
        ));
    }
}