added tests for CSRF session token