temporarily disabled csrf check for login via widget