fix CSRF attack property for notes create api endpoint