fix CSRFDefender bug