template: GET need no csrf token