added test cases for CSRF token rotation