add csrf decorator for some post methods