check CSRF token
retain user in request