fixed csrf token handling