fix passing csrf token for authorization