bug fix: added csrf_exempt for tap_phone