better csrf implementation