You need to update your configuration file to set specific controller methods that should bypass the CSRF check. You can update /config/blesta.php, then find and update
Configure::set('Blesta.csrf_bypass', array());
to:
Configure::set('Blesta.csrf_bypass', array('client_login::index', 'client_login::reset'));
That will disable the CSRF check on the client login and client reset password pages.
The ISO-3166 for Bangladesh includes multiple districts and divisions, and some of the divisions have the same name as the district, hence why "Chittagong" appears duplicate--one refers to the division and the other refers to the district. If you need to update the States in Blesta to better represent provinces in your area more specifically than the ISO-3166 can represent, you can try the States&Countries plugin to update them.