recover from bad CSRF tokens without requiring a hard refresh of the browser