pass csrf tokens when running reports