Add csrf tokens to menu urls that need it.