trying to minimize damage with failed csrf protection attempt