check the csrf token for POST *and* PUT requests