validate xsrf token before POST request