less buggy csrf protection