more CSRF protection tests