rolled back csrf changes