CSRF script fallback set to cookie