csrf validation fix on delete