update environment, set crsf_protection=false