fixed csrf issue for account page