delete the cookie stuff
different csrf on every request