finish admin setup, handle CSRF token