added csrf token metatag to post request headers