csrf_token_id normalization and test