only fetch csrf_token if necessary