disable csrf for tests
use request.agent() instead of maintaining the session in cookies