removed csrf filters before setting domain