try to pass csrf token