fix csrf
functional tests