fixed verifying CSRF token authenticity