removed csrf check for consume