sorting out when to request csrf token