setting the csrf token conditionally