add csrf handling to worker
add test case for csrf
add api test