sample code that uses a csrf token