After cookie is set, page must be refreshed for CSRF to work