remove session referer if csrf fails