don't set csrf token in options