switch to encrypted sessions. Added csrf-token to header