csrf needs to be before the ckeditor