try-catch to avoid csrf missing