cache for longer for now
improve XSRF handling