get a non-csrf-verified allocation post working