Fixed a bug that event can be finalized with a wrong csrf token