fixing csrf on client