stop generating masked csrf tokens for now