set XSRF-TOKEN in index.js rather than the lusca/index.js file