fixed some issues around the csrf protection