[plugin:dbsync] support "HYP_CSRF_TOKEN"