add csrf token in demo signin
mindCanSeeProfile policy