fix move document with csrf token