disabled CSRF for Collage