Bugfix/537 csrf protection