allowed use of custom csrf cookie name in js