remove antiforgery token on selfhost