bypass remote_function (obsolete anyway) to remove CSRF token (may be cached)