checking csrf and facebook theory
theory proven wrong