try to fix csrf_token