FIX: CSRF token retrieval bug