fixed CSRF problem that prevented POST requests