fix redirections -- post reqs now use csrf protection