fixes csrf with mediauploader.ashx