csrf extension and validate filter