csrf and a UTF-8 on email