fix csrf cookie not set
merge