config -- remove except form CSRF attacks