added csrf tests