* doing csrf token verifications all over the place
* when creating csrf token, sends the token to the back-end for later
verifications