variation of csrf and head status