better CSRF handling re: CI/JS