disable csrf, not really a big deal for this type of site, and akamai/rhuffman breaks it