fix errors with custom middleware that adds csrf token to every route