csrf: remove deletion of _csrf