bugfix: subscriptions are also needed for cupcake
bugfix: csrf token needed for /page