create csrf-tokens and validates them; first commit