we want CSRF so remove the exemption