add hidden csrf token for authorization