fixes csrf vuln when creating new objects