+ csrf check exempted in video mapping app