fix XSRF problem