fixed guessable CSRF token when detect_record_change, thanks Stephen Röttger