add xsrf token to model