replace global xsrf with xsrf.Provider