fallback patch for csrf-token migration