shouldn't it be ``string`` instead of ``mixed`` ? The ``CsrfToken`` class expects the token to be astring (see ``__toString``)