fixed xsrf token login creation bug