Change order of middleware so tests still pass with csrf