xsrf's defaut time set to 0 & fix ts not use