some hacky csrf implementation