#27 playing with setting csrf cookie - not working yet