csrf token handling on sign_in/sign_out