remove hardcode of cookie name for CSRF-token