You only need it in the metadata if you are using javascript to submit data
In your form you need a hidden form input field containing the csrf_token, or for convenience, use the helper {{csrf_field()}} which will do the job of creating a hidden field for you. (you can't just use the token helper on its own)
If you are still having issues then you need to check that sessions are being managed correctly.
Try clearing your cookies. I ran into the same problem when I set the domain value in config/session.php in Laravel 5.3.19. Deleting the cookie solved the problem.
In my case I solved that by chmod -R 777 to the folder storage/framework/sessions, because Filesystem.php was denied permission to access the sessions folder.
Consider looking at laravel.log to see what exactly happens in the background.