build bdfzer callback with CSRF bug
fix csrf bug