fix protect from forgery for json