fix csrf event listener