csrf check removed for password functions