diff --git a/performance/lib/test.js b/performance/lib/test.js
new file mode 100644
index 0000000000000000000000000000000000000000..e88531b1194e7a8ac93db129e23e6f1f446232c4
--- /dev/null
+++ b/performance/lib/test.js
@@ -0,0 +1,19 @@
+const wcli = require("./wsapi_client.js");
+
+// lets create a user!
+
+// we'll need a cookie jar (client context)
+var ctx = {};
+
+// and a configuration (what server we're talking to)
+var cfg = { browserid: 'http://127.0.0.1:10002' }
+
+// now start the dance with a call to stage_user
+wcli.post(cfg, '/wsapi/stage_user', ctx, {
+  email: 'first@fakeemail.com',
+  pass: 'firstfakepass',
+  pubkey: 'fakepubkey',
+  site:'fakesite.com'
+}, function (r) {
+  console.log(r.body);
+});
diff --git a/performance/lib/wsapi_client.js b/performance/lib/wsapi_client.js
index 3b8d3b73a6bff43471e56498dcdb55bb0854ade6..4772632c21043ab67aba294db7e75d7313086acb 100644
--- a/performance/lib/wsapi_client.js
+++ b/performance/lib/wsapi_client.js
@@ -44,7 +44,8 @@
 const
 http = require('http'),
 https = require('https'),
-url = require('url');
+url = require('url'),
+querystring = require('querystring');
 
 function injectCookies(ctx, headers) {
   if (ctx.cookieJar && Object.keys(ctx.cookieJar).length) {
@@ -101,17 +102,17 @@ exports.get = function(cfg, path, context, cb) {
 };
 
 function withCSRF(cfg, context, cb) {
-  if (context.csrf) cb();
+  if (context.csrf) cb(context.csrf);
   else {
     exports.get(cfg, '/wsapi/csrf', context, function(r) {
       context.csrf = r.body;
-      cb();
+      cb(context.csrf);
     });
   }
 }
 
 exports.post = function(cfg, path, context, postArgs, cb) {
-  withCSRF(cfg, context, function() {
+  withCSRF(cfg, context, function(csrf) {
     // parse the server URL (cfg.browserid)
     var uObj;
     var meth;
@@ -128,7 +129,7 @@ exports.post = function(cfg, path, context, postArgs, cb) {
     injectCookies(context, headers);
 
     if (typeof postArgs === 'object') {
-      postArgs['csrf'] = g_csrf;
+      postArgs['csrf'] = csrf;
       body = querystring.stringify(postArgs);
     }