restored the CSRF token handling
adding a few more tests on the email client