Fixed serious bug with csrf token cookie