no csrf check on pdf posts