fix #26 add xsrf function