fixed a bug in the CSRF protection setup that caused services to return http 403 due to the CSRF protection