enable csrf because of the admin site