implemented JS csrf fix