Fixed check for identity when returning csrf token