skip csrf checking for send_click action