linting csrf.js