added fake anti-csrf token attribute for now