Fixed CSRF bug that was clearing the token on GET requests