more CSRF tokens on more pages