custom middleware to initiate csrf 'token' for each request