modify token to req.csrfToken()