fix failing test
more appropriate error code
no, content doesn't vary with the CSRF cookie
small refactoring
don't generate a csrf token if we're not going to use it