gen xsrf on the server