use get for csrf token retrieval