fix: content type
fix: response
disable csrf token check