allow CSRF token on the query string too