added draft of csrf-token-should-not-be-session-id