fixed CSRF cookie not being set