moved checking of the xsrf tokens to after cache check