don't generate a csrf token if we're not going to use it