Add test for missing csrf_token