fix bug: POST without csrf token, then session is clear