fix timing attack on X-XSRF-TOKEN