drafted csrf problem documentation