flash csrf and authentication