add csrf token to patch

Likely the wrong place to put this function, but I needed it to grab the cookie for the header.

The API now returns 202 when you patch, which is what is expected.