setupwizard: no need for csrf