fix: check for csrf token only if POST request for reset_continue view