csrf token added in session manager