Fix bug with csrf token