probably shouldn't blank out csrf token...