fix main-is of csrf.hs.