ensure csrf token sent in cookie from homepage view; fixes problems with incognito