protect from forgery isn't useful yet, and it's screwing up my api stuff