checking of state (CSRF) token