bug fix in csrf class