fixed CSRFProtection_RestApiExtension