remove Cross Site Request Forgery protection