apply comment checkCSRF()