add a csrf token to the session