implemented a way to disable CSRF