add missing xsrf token for changing role