check XSRF-Token (refs #72)