disabling csrf policy filter in share