re-work how the api token/csrf is setup locally