only made the publication PUT command CSRF-protected
Merge pull request #187 from Pomax/bug899136

only made the publication PUT command CSRF-protected