add a way to set csrf tokens.