fixed csrf token processing