lets try csrf token - also unset on logout