use csrf_token helper to ensure cookie is created when page loads