add isTokenMatch() for 'csrf token'; change protect from 'remote post' to 'csrf token'