csrf_token seems to have been out of scope where it was previously.