removed senseless csrf stuff