figuring out csrf token