primary logic behind csrf tokens