first attempt at disabling CSRF protection