update csrf-tokens to 2
2.1.2