add support for csrf
add tests for csrf