csrf null session for api and specs update