removed redundant csrf check