When logging in the csrf token changes, so pass it back with the login response. Makes take shifts work.