[update] more refactoring need a way to get new csrf token