Fixed an issue to make it possible to save "allow dtd" setting.
A fix to handle csrf token when updating status for a metadata.