removed check for csrf headers