core xsrf protection implemented