fix custom csrf handling