added csrf token to response headers