fix tests to work with auto csrf