fixed typo and simplified CSRF check