csrf bug solved