csrf meta tag
passing role string not symbol