fix #57 possible CSRF in readfolder action