use StringUtils for csrf filter. add tests