0.4.1: fix small bug pulling out csrf token