allow csrf to be ignored (set to blank); for use in some distributed server situations
hard-coding topic urls to start with /topics