fixed CSRF issue, and CSRF is switched on now