Fix/missing csrf field

fixes #395