fix missing error variable
fix bug where some characters in csrf might make it fail if it is not urlencoded