change csrf getter from a constant to a service
toggle whether or not the join controller should show CTAs after a successful user creation