skip csrf only on local requests