modified CSRF cookie