image upload sends the csrf token now