add x-crsf token for posting image