Fix: move XSRF-Token in cookie