fix/mod 'nice' params; add missing logic for csrf_token