temp removing csrf middleware for non-chromium functionality