fixed csrf exemption

now that i finally found out how to test for it