login with csrf token