Add CSRF token in metadata thumbnail services