added csrf protection for syncing