matcher and additional test coverage
wire in the csrf matcher