commented csrf requirement