removed csrf token to the downloads