add csrf middleware to testing config