implement auto csrf protection on zmi forms