#34 sessions needs to be working to generate the _csrf token