changed handling of csrf token for the button logins: set token with js