added CSFR protection for admin interface