add filter to skip CSRF verification