moving crsf token to stand alone cookie