delete session-management ref for csrf #34