[Web] add missing csrf-token