renamed csrf_token to XSRF-TOKEN