fixed some csrf issues