Agreed: 1) SQL is not solved in an ORM sense. Yes you will have to write sql statements. I'm not so sure this is a bad thing.

Beg-to-differ: 1) Templating works very well for me. You can pass variables to embedded template "partials" within a template. You can define your own functions for the templating engine to use etc. 2) net/http + gorilla (or something similar) and you have all of net/http exposed with some sugar on top. 3) csrf tokens are just a simple library. Yes you do have to be sure to put them into your templates.

If you are having difficulty with a middle-ware concept in terms of golang there are plenty of resources online.

So I would say that I have a different feeling about making websites in golang :) I enjoy it.