fixed: csrf token is const