Moves csrf_token for the time being to layout.