disabled json_csrf attack protection