support running behind a csrf middleware instead of just in front