fix post handling (csrf) for api