unit tests for csrf helper