remove most resource path out of csrf which cause fail to load resource