only send XSRF token when logged in
TODO WIP WIP WIP smokier smoke test