xsrf removed

- well be handling that latter
- shit gets cray when tested in production