fix CSRF in POST_use_item