updateProps should not care about cross site forgery