added assertion to test_csrf for correct 403 response when no CSRF token is provided