ticket reply: add anti-xsrf token