lazy fetch csrf tokens in dialog immediately before a post request which requires them.  fixes csrf race condition in beta and dev