fixes CSRF when starring packages