add csrf token to settings and pairing views