add missing csrf and tokens
add token
update token handling