Include CSRF token for 'login as' action