make sure .csrfToken() is called after app.router