make csrfguard work