add required csrf token when removing a host