Removed csrf for the controller