test prefix with csrf_token