csrf setup for client code