use tokens instead of csrf as object