CSRF example extracting user token with JavaScrip