reports csrf fix