csrf: pass csrf token via script instead of meta tag