fix bogus error message
test that without csrf tokens, requests fail - to be extended to include positive tests