moved CSRF generator to request parser instead of confirmation controller