modified csrf_token to take function instead of session