fixed csrf tokenization for signup, start verification