csrf where token validation depends on request method