replaced requires_csrf_token with ensure_csrf_cookie