show csrf-token on node