Remove hardcoded csrf token