disable csrf for pay_status_l