Fix: _csrf is deprecated use csrfToken() insetad.