use cookie prefix on xsrf cookie
cleanup prefix usage