move this back down to after the route that says it has to go before csrf. Then we can file a but to examine whether that's still true.