thin constants, priming csrf call