panorama: make commands work with csrf protection