wip csrf

Change-Id: I8a24b39c95cff692acaeca9bc09e013f869e6b3f