Fixed  _xsrf by magic. I think Tornado have a bag with _xsrf or have magic logic for setting this cookie.