fixing csrf decorator bug