prevent errors when _csrf_token has not already been set