csrf, fix errors