add _check_csrf option to enable verification