Proper way of token CSRF token inject