use x-www-form-urlencoded for unit tests
added anti-forgery token support