made csrf_token flexible