add tests for anticsrf and incorrect content type requests