add CSRF token to move node POST