re-enabling CSRF protection