check CSRF token with search