fix csrf mistakenly rendered in URL