no csrf on reference saving