csrf protection for exercise attempts