fixed csrf tokens saved in cache even if cache is disabled