fixed csrf/json errors