add missing csrf_token when deleting device