skip CSRF protection for static pages.
release v2.1.2.