for contentview urls, add csrf token automatically