spec only cares about presence of csrf token, not length