stop csrf from blocking shot updater