profile: use anti-XSRF token