implementing csrf token (like 6.5.1 do)