added CSRF detection