a few more CSRF tests