re-enable CSRF attack protection