account for websocket requests in csrf