added fix for nginx CSRFPolicy