fixed bug, missing csrf token at settings->images_post