init csrf token before serving static