make sure csrf tokens are url safe
1.0.4