handle possibly-quoted csrf token properly