Updated CSRF token handling