turn XSRF protection off until we find a solution