add tests for refresh_authenticity_token!