Fix csrf filter bug