temporary solution for CSRF problem - turning off CSRF. TODO turn it on!