disable auto-csrf protection when writing last login time and such