add CSRF token and load eligibilities on confirm page