diff --git a/client/coral-sign-in/containers/SignInContainer.js b/client/coral-sign-in/containers/SignInContainer.js
index 6ddff3d65..49a64f93e 100644
--- a/client/coral-sign-in/containers/SignInContainer.js
+++ b/client/coral-sign-in/containers/SignInContainer.js
@@ -29,7 +29,7 @@ class SignInContainer extends Component {
       displayName: '',
       password: '',
       confirmPassword: '',
-      csrfToken: ''
+      _csrf: ''
     },
     errors: {},
     showErrors: false
@@ -122,7 +122,7 @@ class SignInContainer extends Component {
 
   handleSignIn(e) {
     e.preventDefault();
-    this.state.formData.csrfToken = this.props.csrfToken;
+    this.state.formData._csrf = this.props.csrfToken;
     this.props.fetchSignIn(this.state.formData);
   }
 
diff --git a/tests/routes/api/auth/index.js b/tests/routes/api/auth/index.js
index d99574721..4638ca833 100644
--- a/tests/routes/api/auth/index.js
+++ b/tests/routes/api/auth/index.js
@@ -29,31 +29,41 @@ describe('/api/v1/auth/local', () => {
 
   describe('#post', () => {
     it('should send back the user on a successful login', () => {
-
       agent
         .get('/api/v1/auth')
         .then((res) => {
           expect(res.status).to.be.equal(200);
           expect(res.body).to.have.property('csrfToken');
           return agent.post('/api/v1/auth/local')
-            .send({email: 'maria@gmail.com', password: 'password!', csrfToken: res.body.csrfToken})
-            .catch((res2) => {
+            .send({email: 'maria@gmail.com', password: 'password!', _csrf: res.body.csrfToken})
+            .then((res2) => {
               expect(res2).to.have.status(200);
               expect(res2).to.be.json;
               expect(res2.body).to.have.property('user');
               expect(res2.body.user).to.have.property('displayName', 'Maria');
+            })
+            .catch((error) => {
+              expect(error).to.be.null;
             });
+        })
+        .catch((error) => {
+          expect(error).to.be.null;
         });
     });
 
     it('should not send back the user on a unsuccessful login', () => {
-      return chai.request(app)
-        .post('/api/v1/auth/local')
-        .send({email: 'maria@gmail.com', password: 'password!3'})
-        .catch((err) => {
-          expect(err).to.not.be.null;
-          expect(err.response).to.have.status(401);
-          expect(err.response.body).to.have.property('message', 'not authorized');
+      agent
+        .get('/api/v1/auth')
+        .then((res) => {
+          expect(res.status).to.be.equal(200);
+          expect(res.body).to.have.property('csrfToken');
+          return agent.post('/api/v1/auth/local')
+            .send({email: 'maria@gmail.com', password: 'password!3',  _csrf: res.body.csrfToken})
+            .catch((err) => {
+              expect(err).to.not.be.null;
+              expect(err.response).to.have.status(401);
+              expect(err.response.body).to.have.property('message', 'not authorized');
+            });
         });
     });
   });
diff --git a/tests/routes/api/comments/index.js b/tests/routes/api/comments/index.js
index f20fe53f2..909c2e9b2 100644
--- a/tests/routes/api/comments/index.js
+++ b/tests/routes/api/comments/index.js
@@ -4,6 +4,8 @@ const app = require('../../../../app');
 const chai = require('chai');
 const expect = chai.expect;
 
+const agent = chai.request.agent(app);
+
 // Setup chai.
 chai.should();
 chai.use(require('chai-http'));
@@ -177,25 +179,35 @@ describe('/api/v1/comments', () => {
     }));
 
     it('should create a comment', () => {
-      return chai.request(app)
-        .post('/api/v1/comments')
-        .set(passport.inject({roles: []}))
-        .send({'body': 'Something body.', 'author_id': '123', 'asset_id': asset_id, 'parent_id': ''})
-        .then((res) => {
-          expect(res).to.have.status(201);
-          expect(res.body).to.have.property('id');
+      agent
+        .get('/api/v1/auth')
+        .then((resa) => {
+          expect(resa.status).to.be.equal(200);
+          expect(resa.body).to.have.property('csrfToken');
+          return agent.post('/api/v1/comments')
+            .set(passport.inject({roles: []}))
+            .send({'body': 'Something body.', 'author_id': '123', 'asset_id': asset_id, 'parent_id': '', _csrf: resa.body.csrfToken})
+            .then((res) => {
+              expect(res).to.have.status(201);
+              expect(res.body).to.have.property('id');
+            });
         });
     });
 
     it('should create a comment with a rejected status if it contains a bad word', () => {
-      return chai.request(app)
-        .post('/api/v1/comments')
-        .set(passport.inject({roles: []}))
-        .send({'body': 'bad words are the baddest', 'author_id': '123', 'asset_id': asset_id, 'parent_id': ''})
-        .then((res) => {
-          expect(res).to.have.status(201);
-          expect(res.body).to.have.property('id');
-          expect(res.body).to.have.property('status', 'rejected');
+      agent
+        .get('/api/v1/auth')
+        .then((resa) => {
+          expect(resa.status).to.be.equal(200);
+          expect(resa.body).to.have.property('csrfToken');
+          return agent.post('/api/v1/comments')
+            .set(passport.inject({roles: []}))
+            .send({'body': 'bad words are the baddest', 'author_id': '123', 'asset_id': asset_id, 'parent_id': '', _csrf: resa.body.csrfToken})
+            .then((res) => {
+              expect(res).to.have.status(201);
+              expect(res.body).to.have.property('id');
+              expect(res.body).to.have.property('status', 'rejected');
+            });
         });
     });
 
@@ -208,10 +220,14 @@ describe('/api/v1/comments', () => {
             .then(() => asset);
         })
         .then((asset) => {
-          return chai.request(app)
-            .post('/api/v1/comments')
-            .set(passport.inject({roles: []}))
-            .send({'body': 'Something body.', 'author_id': '123', 'asset_id': asset.id, 'parent_id': ''});
+          return agent.get('/api/v1/auth')
+            .then((resa) => {
+              expect(resa.status).to.be.equal(200);
+              expect(resa.body).to.have.property('csrfToken');
+              return agent.post('/api/v1/comments')
+                .set(passport.inject({roles: []}))
+                .send({'body': 'Something body.', 'author_id': '123', 'asset_id': asset.id, 'parent_id': '', _csrf: resa.body.csrfToken});
+            });
         })
         .then((res) => {
           expect(res).to.have.status(201);
@@ -230,10 +246,14 @@ describe('/api/v1/comments', () => {
             .then(() => asset);
         })
         .then((asset) => {
-          return chai.request(app)
-            .post('/api/v1/comments')
-            .set(passport.inject({roles: []}))
-            .send({'body': 'This is way way way way way too long.', 'author_id': '123', 'asset_id': asset.id, 'parent_id': ''});
+          return agent.get('/api/v1/auth')
+            .then((resa) => {
+              expect(resa.status).to.be.equal(200);
+              expect(resa.body).to.have.property('csrfToken');
+              return agent.post('/api/v1/comments')
+                .set(passport.inject({roles: []}))
+                .send({'body': 'This is way way way way way too long.', 'author_id': '123', 'asset_id': asset.id, 'parent_id': '', _csrf: resa.body.csrfToken});
+            });
         })
         .then((res) => {
           expect(res).to.have.status(201);
@@ -249,10 +269,14 @@ describe('/api/v1/comments', () => {
         closedMessage: 'tests said expired!'
       })
       .then((asset) => {
-        return chai.request(app)
-          .post('/api/v1/comments')
-          .set(passport.inject({roles: []}))
-          .send({'body': 'Something body.', 'author_id': '123', 'asset_id': asset.id, 'parent_id': ''});
+        return agent.get('/api/v1/auth')
+          .then((resa) => {
+            expect(resa.status).to.be.equal(200);
+            expect(resa.body).to.have.property('csrfToken');
+            return agent.post('/api/v1/comments')
+              .set(passport.inject({roles: []}))
+              .send({'body': 'Something body.', 'author_id': '123', 'asset_id': asset.id, 'parent_id': '', _csrf: resa.body.csrfToken});
+          });
       })
       .then((res) => {
         expect(res).to.have.status(500);
@@ -270,10 +294,14 @@ describe('/api/v1/comments', () => {
         closedMessage: 'tests said expired!'
       })
       .then((asset) => {
-        return chai.request(app)
-          .post('/api/v1/comments')
-          .set(passport.inject({roles: []}))
-          .send({'body': 'Something body.', 'author_id': '123', 'asset_id': asset.id, 'parent_id': ''});
+        return agent.get('/api/v1/auth')
+          .then((resa) => {
+            expect(resa.status).to.be.equal(200);
+            expect(resa.body).to.have.property('csrfToken');
+            return agent.post('/api/v1/comments')
+              .set(passport.inject({roles: []}))
+              .send({'body': 'Something body.', 'author_id': '123', 'asset_id': asset.id, 'parent_id': '', _csrf: resa.body.csrfToken});
+          });
       })
       .then((res) => {
         expect(res).to.have.status(201);
@@ -438,16 +466,21 @@ describe('/api/v1/comments/:comment_id/actions', () => {
 
   describe('#post', () => {
     it('it should update actions', () => {
-      return chai.request(app)
-        .post('/api/v1/comments/abc/actions')
-        .set(passport.inject({id: '456', roles: ['admin']}))
-        .send({'action_type': 'flag', 'detail': 'Comment is too awesome.'})
-        .then((res) => {
-          expect(res).to.have.status(201);
-          expect(res).to.have.body;
-          expect(res.body).to.have.property('action_type', 'flag');
-          expect(res.body).to.have.property('detail', 'Comment is too awesome.');
-          expect(res.body).to.have.property('item_id', 'abc');
+      agent
+      .get('/api/v1/auth')
+        .then((resa) => {
+          expect(resa.status).to.be.equal(200);
+          expect(resa.body).to.have.property('csrfToken');
+          return agent.post('/api/v1/comments/abc/actions')
+            .set(passport.inject({id: '456', roles: ['admin']}))
+            .send({'action_type': 'flag', 'detail': 'Comment is too awesome.', _csrf: resa.csrfToken})
+            .then((res) => {
+              expect(res).to.have.status(201);
+              expect(res).to.have.body;
+              expect(res.body).to.have.property('action_type', 'flag');
+              expect(res.body).to.have.property('detail', 'Comment is too awesome.');
+              expect(res.body).to.have.property('item_id', 'abc');
+            });
         });
     });
   });
diff --git a/tests/routes/api/user/index.js b/tests/routes/api/user/index.js
index 4c0c293d0..c2ea806b7 100644
--- a/tests/routes/api/user/index.js
+++ b/tests/routes/api/user/index.js
@@ -4,6 +4,8 @@ const app = require('../../../../app');
 const chai = require('chai');
 const expect = chai.expect;
 
+const agent = chai.request.agent(app);
+
 // Setup chai.
 chai.should();
 chai.use(require('chai-http'));
@@ -28,16 +30,21 @@ describe('/api/v1/users/:user_id/actions', () => {
 
   describe('#post', () => {
     it('it should update actions', () => {
-      return chai.request(app)
-        .post('/api/v1/users/abc/actions')
-        .set(passport.inject({id: '456', roles: ['admin']}))
-        .send({'action_type': 'flag', 'detail': 'Bio is too awesome.'})
-        .then((res) => {
-          expect(res).to.have.status(201);
-          expect(res).to.have.body;
-          expect(res.body).to.have.property('action_type', 'flag');
-          expect(res.body).to.have.property('detail', 'Bio is too awesome.');
-          expect(res.body).to.have.property('item_id', 'abc');
+      agent
+      .get('/api/v1/auth')
+        .then((resa) => {
+          expect(resa.status).to.be.equal(200);
+          expect(resa.body).to.have.property('csrfToken');
+          return agent.post('/api/v1/users/abc/actions')
+            .set(passport.inject({id: '456', roles: ['admin']}))
+            .send({'action_type': 'flag', 'detail': 'Bio is too awesome.', _csrf: resa.csrfToken})
+            .then((res) => {
+              expect(res).to.have.status(201);
+              expect(res).to.have.body;
+              expect(res.body).to.have.property('action_type', 'flag');
+              expect(res.body).to.have.property('detail', 'Bio is too awesome.');
+              expect(res.body).to.have.property('item_id', 'abc');
+            });
         });
     });
   });