add tests for csrf-protection with http header X-CSRF-TOKEN