trying to fix csrf bug