don't require CSRF token for now (will create ticket)