remove csrf here too

though I think the real problem is session management